Critical Remote Code Execution in Microsoft Internet Explorer (CVE‑2013‑1347)
What It Is – CVE‑2013‑1347 is a memory‑corruption flaw in Microsoft Internet Explorer that allows an attacker to execute arbitrary code in the context of the current user. The vulnerability is tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Exploitability – Public exploit code has been observed; the vulnerability is rated High severity (CVSS ≈ 8.8). No authentication is required beyond a user visiting a malicious web page.
Affected Products – Microsoft Internet Explorer 8‑11 on Windows 7, Windows 8/8.1, and Windows 10 (all supported editions at the time of the advisory).
Why It Matters for Trust & Control Assurance
- Patch Management / Vulnerability Remediation – Demonstrating timely patching satisfies a core control objective that underpins dozens of frameworks (e.g., NIST CSF Identify‑Protect, ISO 27001 A.12.6).
- Evidence of Due Diligence – Continuous collection of patch‑status evidence creates a defensible audit trail that buyers increasingly demand.
- Risk of Credential Exposure – Exploiting the flaw in a logged‑in user’s session can lead to credential theft, amplifying downstream access‑control risks.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2013‑1347 on all affected endpoints immediately.
- Verify patch deployment through automated inventory and compliance tools; capture screenshots or logs as evidence.
- If legacy applications require IE, isolate them in a hardened sandbox or upgrade to a supported browser.
- Update your vulnerability‑management process to include continuous monitoring for KEV listings.
Source: CISA KEV – CVE‑2013‑1347